#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/fs.h>
#include <linux/device.h>
#include <linux/miscdevice.h>
#include <linux/cred.h>
#include <linux/proc_fs.h>
#include <linux/uaccess.h>

#define PWN 0x5566

static int device_open(struct inode *inode, struct file *filp)
{
	printk(KERN_ALERT "Device opened.");
	return 0;
}

static int device_release(struct inode *inode, struct file *filp)
{
	printk(KERN_ALERT "Device closed.");
	return 0;
}

static ssize_t device_read(struct file *filp, char *buffer, size_t length, loff_t *offset)
{
	return -EINVAL;
}

static ssize_t device_write(struct file *filp, const char *buf, size_t len, loff_t *offset)
{
	return -EINVAL;
}

static long device_ioctl(struct file *filp, unsigned int ioctl_num, unsigned long ioctl_param)
{
	printk(KERN_ALERT "Got ioctl argument %d!", ioctl_num);
	if (ioctl_num == PWN) {
		if (ioctl_param == 0x12341234) {
			printk(KERN_ALERT "Granting root access!");
			commit_creds(prepare_kernel_cred(NULL));
		}

		if (ioctl_param == 0x12341) {
			printk(KERN_ALERT "Escaping seccomp!");
			printk(KERN_ALERT "FLAGS BEFORE: %lx", current->thread_info.flags);
			current->thread_info.flags &= ~_TIF_SECCOMP;
			printk(KERN_ALERT "FLAGS AFTER: %lx", current->thread_info.flags);
		}
	}

	return 0;
}

static struct file_operations fops = {
	.read = device_read,
	.write = device_write,
	.unlocked_ioctl = device_ioctl,
	.open = device_open,
	.release = device_release
};

struct proc_dir_entry *proc_entry = NULL;

/* Init function called on module entry */
int my_module_init( void )
{
	proc_entry = proc_create("pwn-college-root", 0666, NULL, &fops);
	printk(KERN_INFO "my_module_init called.  Module is now loaded.\n");

	return 0;
}

/* Cleanup function called on module exit */
void my_module_cleanup( void )
{
	if (proc_entry) {
		proc_remove(proc_entry);
	}
	printk(KERN_INFO "my_module_cleanup called.  Module is now unloaded.\n");
	return;
}

/* Declare entry and exit functions */
module_init( my_module_init );
module_exit( my_module_cleanup );

MODULE_LICENSE("GPL");




#if 0

Note : 直接在PC上加载运行！

https://xz.aliyun.com/news/14272?time__1311=eqUxuiDtitDQi%3DD8D9DBLadrGQdbdO7kSxkiD&u_atoken=1c5d1b1d0719d042a3ae4ffd70975081&u_asig=1a0c384b17429708128448808e003b
https://xz.aliyun.com/news/14273?time__1311=eqUxuiDtitDQi%3DD8YD%2F8nbeYuSOFK%3Dq174D&u_atoken=e811642b84f4e1f7f59aa702c7e92157&u_asig=0a472f8317429539304074652e003a
https://mp.weixin.qq.com/s/Ak6t1hNsCot1D7leLwzzLA
#endif


